Initial Build

[coolamit]

Themis: a composite GitHub Action that runs Open Code Review (OCR) CLI on pull requests and publishes findings as inline review comments via a static, dependency-free Go binary.

What's included

• themis-publish Go binary (stdlib only, zero external dependencies):
  • Strict decoder for OCR's JSON output, with a schema-drift safety net that suggests pinning ocr-version
  • Content fingerprinting so findings survive line drift, LLM rewording, and whitespace churn — no duplicate comments across pushes
  • Comment rendering with severity icons and one-click GitHub suggestion blocks, guarded so a stale suggestion can never apply a wrong patch
  • Severity-based comment budgeting (critical findings exempt up to their own cap) plus an overflow summary comment so nothing is ever dropped
  • GitHub REST publisher: reviews batched at 50 comments, individual retry on 422, posts nothing when there is nothing new
  • Optional merge gate via fail-on-severity (exit code 2, distinct from operational failures)
• Composite action (action.yml): 21 inputs, performs its own checkout of the trusted base, credential preflight that distinguishes fork PRs from misconfiguration, LLM connectivity gate, and a label-triggered manual mode that verifies the labeler has write access
• Helper scripts: OCR install with sha256 verification for pinned versions, ref resolution that fetches the PR head as git objects only (never checked out), label guard, and always-run label cleanup — all shellcheck-clean
• Workflows: CI (gofmt, vet, tests, shellcheck, bats, actionlint, input-consistency check) and release (master-ancestry guard, static linux/amd64 build, SHA-256 checksums, moving latest tag)
• Docs: README with provider recipes, the trigger-mode matrix, security notes, and versioning guidance, plus a copy-paste example workflow

Testing

• Go unit tests across all four packages, including real OCR v1.8.4 output fixtures and an httptest-backed publisher suite
• 20 bats tests for the scripts, including a real git-origin fixture for merge-base resolution
• actionlint on the workflows and example; a consistency script cross-checks every declared action input